yt-competitive-analysis
Pass
Audited by Gen Agent Trust Hub on Aug 19, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill consists of a Python script (
analyze.py) designed for data retrieval and processing. It does not utilizeos.system,subprocess, orevalfor executing system commands or arbitrary code. - [EXTERNAL_DOWNLOADS]: The
requirements.txtfile is empty, and the script relies solely on the Python standard library (such asurllib.request). It does not download or execute remote scripts or third-party packages. - [DATA_EXFILTRATION]: Network activity is strictly limited to
www.googleapis.comfor interacting with the YouTube Data API. No sensitive system data is accessed, and no information is transmitted to unauthorized external domains. - [CREDENTIALS_UNSAFE]: The skill follows security best practices by prompting the user to provide a YouTube API key via an environment variable or command-line argument rather than using hardcoded credentials.
- [INDIRECT_PROMPT_INJECTION]: The script processes external data (YouTube video titles). While this presents a theoretical surface for indirect injection if the titles contained malicious instructions, the script treats these as strings for display and word frequency analysis, with no capability to execute them or pass them to an unsafe interpreter.
Audit Metadata